How do I configure a custom rule to allow a specific host name in AWS WAF? 

Resolution

To limit access to your application, create custom rules based on headers, such as the Host header. The rules must either allow traffic for a specific host name or block traffic that isn't for a specific host name.

Allow traffic for a specific host name 

Complete the following steps:

1. Open the AWS WAF Console.
2. In the navigation pane, under AWS WAF, choose Protection packs (web ACLs).
3. Select the protection pack (web ACL) that you want to edit. This opens a side pane with details you can edit.
4. Choose Manage rules and then, choose Add rule.
5. On the Add new rule page, choose Custom rule and then, choose Next.
6. On the Choose rule type page, choose Custom rule and then choose Next.
7. Add the following values to set up your rule:
   For Action, choose Allow.
   For Rule name, enter a name for the rule.
   For If a request, choose matches the statement.
   For Inspect, choose Single header.
   For the Header field name, enter Host.
   For Match type, choose Exactly matches string.
   For String to match, type the host name you want to allow.
   (Optional) For Text transformation, choose a text transformation, or choose None.
   (Optional) Expand the Custom request – optional section and then, choose Add new custom header. Then enter a value for the Key and Value fields.
8. Choose Add rule.
9. (Optional) To change the priority of the rule, choose Edit rule order. Drag the rule up or down to the desired position in the list and then, choose Save rule order.

Block traffic that isn't for a specific host name

Complete the following steps:

1. Open the AWS WAF Console.
2. In the navigation pane, under AWS WAF, choose Protection packs (web ACLs).
3. Select the protection pack (web ACL) that you want to edit. This opens a side pane with details you can edit.
4. Choose Manage rules and then choose Add rule.
5. On the Add new rule page, choose Custom rule and then choose Next.
6. On the Choose rule type page, choose Custom rule and then choose Next.
7. Add the following values to set up your rule:
   For Action, choose Block
   For Rule name, enter a name for the rule.
   For If a request, choose does not match the statement (NOT).
   For Inspect, choose Single header.
   For the Header field name, type Host.
   For Match type, choose Exactly matches string.
   For String to match, type your host name to block everything except that host name.
   (Optional) For Text transformation, choose a text transformation, or choose None.
8. (Optional) Expand the Custom response – optional section and then, select Enable. Then configure the response code, headers, and body.
9. Choose Add rule.
10. (Optional) To change the priority of the rule, choose Edit rule order. Drag the rule up or down to the desired position in the list and then, choose Save rule order.

It's a best practice to use logical rule statements to combine string match statements with other statement types, such as IP set match statements and geographic match statements.

Related information

Logging AWS WAF protection pack (web ACL) traffic

How labeling works in AWS WAF

Customized web requests and responses in AWS WAF